Privacy Policy

1. Data controller

The controller of data processed in this EFIP installation is ETHERNECO LTD, a company registered in England and Wales under number 14648043, registered office: The Accountancy Partnership, 70 Grange Road East, Wirral, United Kingdom, CH41 5FE.

Send every data-protection matter to [email protected] — the controller’s only contact address.

The company is established in the United Kingdom and offers the service under English law. Processing is governed by the UK Data Protection Act and the UK GDPR, and the supervisory authority is the Information Commissioner’s Office.

If you use EFIP running on your own or your company’s infrastructure, the controller of that data is whoever operates that installation, not the provider of the application.

2. What we process

• Account data: your email address, your password stored only as a hash, and — when you sign in with Google — the email address, name and profile picture Google passes on.
• Data you upload: transactions, statements, invoices, receipts, merchant names, amounts, descriptions and anything else contained in those files.
• Data the application derives: categories, detected subscriptions, statistics and indicators.
• AI analyst conversations: your questions and the model’s answers, stored in the conversation history.
• Technical data: server logs (IP address, timestamp, browser type, requested address) and interface preferences.

3. Purposes and legal bases

• Providing the service — running your account, importing and analysing data: Art. 6(1)(b) UK GDPR (performance of a contract).
• Security, diagnostics and abuse prevention, including server logs: Art. 6(1)(f) UK GDPR (legitimate interest).
• Handling messages and complaints sent by email: Art. 6(1)(b) and (f) UK GDPR.
• Compliance with legal obligations where they arise: Art. 6(1)(c) UK GDPR.

4. Cookies and browser storage

The service uses no advertising or analytics cookies and embeds no third-party tracking scripts. Only strictly necessary and preference cookies are set:

• the sign-in session cookie (NextAuth) — keeps you logged in; the service cannot work without it,
• efip_lang — the site language you picked,
• efip_period and efip_compare — the time range and comparison selected in the dashboard,
• efip_active_org — the active profile (business or personal),
• browser localStorage — your light/dark theme choice and the fact that the cookie notice has already been shown.

5. Why we do not ask for cookie consent

Consent is required for storage that is not needed to provide the service — analytics, profiling and advertising above all. The service uses none of those, so instead of a consent dialog we show a one-off notice, and every feature of the site works without you clicking anything about cookies.

You can delete or block the cookies listed above in your browser settings at any time. Blocking the session cookie will make signing in impossible, and blocking the rest means the site will not remember your language, theme or selected period.

6. The AI analyst and where your questions go

When you ask the analyst a question, the parts of your financial data needed to answer it are sent to the language-model provider configured for the installation: OpenAI, Anthropic, Google or a local Ollama instance.

With a local model (Ollama) nothing leaves the infrastructure the application runs on. With an external provider the content of the request is transmitted to that provider and is subject to its own terms and privacy policy. Choosing the provider is up to whoever configures the installation.

7. Recipients

We do not sell data, do not share it with advertisers and do not use it to train models.

• The infrastructure provider hosting the application and its database.
• The configured AI model provider — for the content of analyst requests.
• Google — only for Google sign-in, and only if you use it.
• Public authorities, where disclosure is required by law.

8. Transfers outside your country

The company operating the service is established in the United Kingdom and the application and its database run on the infrastructure chosen by the controller — your data may therefore be processed outside the country you live in.

If an external AI provider is configured, the content of analyst requests may also be processed in another country, under that provider’s own safeguards. With a local model no such transfer happens at all.

By using the service you accept that processing. If it is not acceptable to you, do not use the service.

9. Retention

Account and financial data are kept until you delete your account or ask us to delete them. Technical logs are kept for a shorter period, normally no longer than a bit over a year, for security and diagnostics. Backups may still contain deleted data until they rotate out.

10. Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, port it, object to processing based on legitimate interest, and withdraw consent where processing rests on it.

Send requests to [email protected].

You may also lodge a complaint with the supervisory authority for the controller, the Information Commissioner’s Office (Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom).

11. Security

Passwords are stored only as hashes, sessions are signed, traffic runs over HTTPS and database queries are scoped to your active profile. No safeguard is absolute, though — use a strong, unique password and do not upload data whose disclosure you could not live with.

12. Children

The service is not intended for people under 16 and we do not knowingly collect their data.

13. Changes to this policy

This policy may be updated as the service evolves. The version published on this page, dated at the top, is the one that applies.